openldap-technical

openldap-technical@openldap.org

9897 discussions

Recommendations for adding "MUST" attribute to in-production objectclass?
by Christopher DeMarco 28 May '09

28 May '09

Greetings, list! I have a custom schema, which defines an objectclass to which all of my "users" belong. I'd like to add a required ("MUST") attribute to that objectclass, but I'm frightened of destroying my users :-) Is the following procedure safe? 1. Add the desired attribute as optional ("MAY") to the objectclass in my schema. Restart slapd. 2. Apply an LDIF change to every node with that particular objectclass, setting that new attribute to some acceptable value. 3. Ensure that my "create a new user" tools will set that attribute. 4. Change my schema to require ("MUST") that attribute within that objectclass. Restart slapd. If not, what is the safe procedure? Is there a better way of adding a required attribute to an in-production objectclass? Thanks! -- Christopher DeMarco <demarco(a)maya.com> IT Director MAYA Group +1-412-708-9660

6 8

ACI and OpenLdap 2.4.11 un debian lenny
by Sebastien Cramatte 27 May '09

27 May '09

Hello How can I use ACI with Openldap 2.4.11 ? I'm running debian lenny and seems that debian package by default has the option --enable-aci I don't have any OpenLDAPAci attribute and OpenLDAPAcl object in core.schema Thank your help Best regards

2 1

Problems with openLDAP and Samba
by Matt Burkhardt 25 May '09

25 May '09

Hope this is the right list - Anyway, I've got openLDAP 2.4.9 on Ubuntu 8.04 along with Samba 3.028 I've got it all installed and used the slapd.d (cn=config) capabilities. I get no errors on start up or stop, can create, modify and delete users and groups. However, I cannot create a user in openLDAP that is usable with Samba. If I go back in and create a Unix user, it will work. I've installed libnss-lapd and configured it - but is this the way it's supposed to work? What should I be looking at? Thanks and sorry for the noob question... -- Matt Burkhardt, M.Sci. Technology Management mlb(a)imparisystems.com (301) 682-7901 502 Fairview Avenue Frederick, MD 21701 http://www.imparisystems.com

3 5

hostObject, host attribute
by François Mehault 25 May '09

25 May '09

Hi all I use the primitive pam_check_host_attr in pam_ldap to filter my users. In OpenLDAP I add the attribute host for each users. I can write « host = hostlab.netplus.fr (fqdn) » to allow just one host for my user, or « host = * » to allow all hosts. But if I write host = 192.168.57.48 (the IP of hostlab.netplus.fr), my user is not able to authenticate on the host, Why I have to write the FQDN and not the IP address. Isn't possible ? And Is it possible to use regexp with the host attribute? Like host = 192.168.45.* ? Regards, François

2 1

Re: Host based authentication using OpenLDAP
by Gavin Henry 25 May '09

25 May '09

----- "Per Kristiansen" <perk(a)funcom.com> wrote: > Hello, I've been working on implementing a LDAP solution for the last > 8 > months (in-between task, you know how it is :D ) Time flies! > I now have a working LDAP directory, have all my users imported, > things > actually work! :D..(jinx!) Excellent work, well done! > But now I wanna get fancy.. > > I've been googeling for some sort of clear description on how I can > set > up a system using groups of hosts and user groups to create a > selective > ACL for ssh'ing to a set of servers based on group membership. > It sounds to me like you are almost here and just need help creating the LDAP groups, ACLs and LDAP search/filters for use with nss_ldap on RHEL 4/5 and Centos? Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

5 12

OpenLDAP 23 client with 24 server?
by Matt Juszczak 25 May '09

25 May '09

Hi All, Most of our boxes are FreeBSD. FreeBSD has ports for openldap22, openldap23, and openldap24. Not using slurpd much anymore in my setups, I decided to run with openldap24 in our recent setup. Setup openldap24 server, and all the FreeBSD clients have openldap24 clients. Everything is working well. Recently, we had to introduce a few RHEL boxes into our setup. We're pointing to the redhat repositories, but they seem to only have openldap23-* client packages. I know I could potentially make my own packages, or perhaps get RPM's from the Internet, but I was wondering if by some chance openldap23 clients (and pam_ldap/nss_ldap libraries) are compatible with openldap24 servers? I would assume the other way around (openldap24 clients with openldap23 servers) would work fine. Thanks! -Matt

3 2

Najmuddin C has sent you a private message
by Najmuddin C 24 May '09

24 May '09

1 0

Matthew GARRETT is out of the office.
by Matthew GARRETT 23 May '09

23 May '09

I will be out of the office starting 22/05/2009 and will not return until 27/05/2009. I will respond to your message when I return. For IT issues please see Drew Harvey Registered in England and Wales No.811900 Registered Office 33 Cavendish Square, London W1G 0PW This e-mail and any attachments are intended only for the person or entity to whom it is addressed and may contain confidential or privileged information. If you are not the addressee, any disclosure, reproduction, copying, distribution, or use of this communication is strictly prohibited. If you are not the intended recipient or person responsible for delivering this message to the named addressee, please notify us immediately and delete this e-mail. It is the responsibility of the addressee to scan this email and any attachments for computer viruses or other defects. The sender does not accept liability for any loss or damage of any nature, however caused, which may result directly or indirectly from this email or any file attached.

1 0

freeBSD 7.0 + passwd + openldap
by François Mehault 22 May '09

22 May '09

Hi all Maybe it's not the good mailing list (sorry !)to post my question, but I hope someone can help me. I use OpenLDAP to authenticate some users. Then I want my users are able to change their passwords themselves with the command passwd. But I have this message : <14:59>[labobe1:~]$ passwd passwd: Sorry, `passwd' can only change passwords for local or NIS users. I read that I have to modify passwd.c in /usr/src/usr.bin/passwd but I can't find this path, I just have /usr/src/sys Is-there another way to change users's password ? Thanks for your help, Regards, François

2 1

Re: Host based authentication using OpenLDAP
by Gavin Henry 22 May '09

22 May '09

> And fyi, here's an example... For a given host: > > dn: cn=hostX,ou=hosts,dc=example,dc=com > objectClass: ipHost > objectClass: authorizedServiceObject > cn: hostX > ipHostNumber: 192.168.1.127 > authorizedService: sshd > authorizedService: ftp > > you use the authorizedService attribute to list the PAM services that > are > available. Then you set ACLs to control who can access each service, > like so: > > access to dn.subtree=ou=hosts,dc=example,dc=com > attrs=authorizedService val.exact=sshd > by group.exact="cn=admins,ou=groups,dc=example,dc=com" write > by peername.ip=192.168.2.0%255.255.255.0 read > by * search > > The overlay performs a Compare operation to check for the required > service, so > if you deny Compare access to a particular service, then users aren't > allowed > to use that service. Very nice! We did something like this for a hosting company that had users accounts with the services that the user was allowed to access and the specific apps had the appropriate filters in the authz/auth searches. Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical